Several folk have asked me to take a look at this:
http://www.darkreading.com/attacks-breaches/cybercriminals-seized-control-of-brazilian-bank-for-5-hours/d/d-id/1328549?_mc=NL_DR_EDT_DR_weekly_20170406&cid=NL_DR_EDT_DR_weekly_20170406&elqTrackId=ebd6c41927c24e3099907130009f169c&elq=4cc869335a354df394b4e640ef369950&elqaid=77725&elqat=1&elqCampaignId=26175
<http://www.darkreading.com/attacks-breaches/cybercriminals-seized-control-of-brazilian-bank-for-5-hours/d/d-id/1328549?_mc=NL_DR_EDT_DR_weekly_20170406&cid=NL_DR_EDT_DR_weekly_20170406&elqTrackId=ebd6c41927c24e3099907130009f169c&elq=4cc869335a354df394b4e640ef369950&elqaid=77725&elqat=1&elqCampaignId=26175>
What happened here was that a hacker took over a banks DNS settings for 5 hours
and performed an extended phishing attack. They then acquired certs for the
domain while they had control of it. So accepting that this is one incident,
albeit one likely very typical of things to come, could CAA have helped?
As it stands, the answer is no because CAA is signaled through the DNS and so
the attackers could control those as well. DNSSEC doesn’t help either and nor
does CT as presently specified. Pinning does solve this one specific problem
but only on TOFU terms.
Some observations:
* Any solution is going to have to involve some form of forward acting
statement ‘do this for the next X hours’.
* We now have two mechanisms that are viable as publication infrastructures -
DNS and CT.
* The problems with pinning are real, very few companies can risk shutting
themselves down for an extended period if they goof. The problem with pinning
is that the time period really does need to be fairly long if it is to be any
use. I do not visit my bank every day. I probably don’t visit for a month at
times.
* A weaker criteria such as ‘must get an EV cert’ or a much shorter time period
than is needed for pinning (24 hours) is much more likely to be acceptable
Ideas?
_______________________________________________
Public mailing list
[email protected]
https://cabforum.org/mailman/listinfo/public
